--- analysis: "Standard alerts on common proxy ports often produce excessive noise from\ \ legitimate business tools. This hunt addresses that gap by scoping the data to\ \ known vulnerable hosts and using prevalence to isolate rare, per-host proxy traffic.\ \ It also monitors for specific research activity on the host itself\u2014an indicator\ \ of an attacker seeking technical context on their breach." blind_spots: - id: no-http-telemetry question: whether the attacker researched the vulnerability directly from the host requires: hb_http_activity on all servers risk: A server without HTTP logging prevents the hunt from seeing research activity, relying solely on rare egress patterns. stage: multi-hop-proxy-c2 - id: unmanaged-devices question: whether vulnerable unmanaged devices are present in the environment requires: complete enrollment in hb_devices risk: The scoping step only sees devices that report to both the vulnerability scanner and the device inventory provider. stage: exploit-public-facing-application coverage: - stage: exploit-public-facing-application status: covered steps: - unresolved-vulnerabilities - stage: multi-hop-proxy-c2 status: covered steps: - rare-proxy-egress - mitre-research-activity guardrails: claims: no_unsupported evidence: citation_required missing_data: not_benign telemetry: untrusted hunt: applicability: campaign-specific handoff: keep-as-periodic-hunt justification: Exploitation of public-facing software provides the primary entry point for intruders. Correlating unpatched vulnerabilities with proxy-based C2 and unusual research activity helps identify compromised servers before data exfiltration occurs. methodology: model-assisted trigger: intel-report hypothesis: An adversary has exploited a critical vulnerability on a public-facing host and is masking command-and-control traffic through a multi-hop proxy or onion routing network. labels: - hunt - attack.t1190 - attack.t1090.003 name: Exploit and Multi-Hop Proxy C2 parameters: lookback_days: default: '14' description: Days of history to examine. type: number proxy_ports: default: - '1080' - '3128' - '8080' - '9001' - '9050' description: Common egress ports used by proxies and Tor nodes. type: list[string] research_paths: default: - /data/definitions/699.html - /data/definitions/513.html description: MITRE CWE/CAPEC paths referenced in the report. from: kind: article observed: '2026-06-23' ref: elastic-security-labs-automation type: list[path] scope_hosts: default: [] description: Hosts to include in behavioral queries; paste hostnames from the scoping step here. type: list[host] provenance: authors: - name: Huntbase hunt generation org: huntbase.io generated: by: huntbase-hunt-generation from: https://www.elastic.co/security-labs/blog/security-advisory-automation-rag-elastic-agent-builder gates: - dry-run - lint model: hb_google/gemini-3-flash-preview rationale: The hunt begins by joining hb_vulnerability_finding and hb_devices to identify specific hostnames with unresolved critical vulnerabilities. For the parallel queries to work correctly, the analyst must copy the hostnames from this first step into the 'scope_hosts' parameter. references: - name: 'From vulnerability report to CVE draft in minutes: how Elastic automated security advisories with AI' url: https://www.elastic.co/security-labs/blog/security-advisory-automation-rag-elastic-agent-builder related: - hunt: tor-exit-node-connections reason: That hunt uses IP intelligence for known Tor nodes, while this hunt focuses on behavioral port patterns and research activity. relation: out-of-scope-alternative scenario: stages: - name: Exploitation of Public-Facing Application observables: - vulnerable software components - product versions - CVE-YYYY-NNNNN - ESA-2026-01 - vulnerability reports - CVSS scores slug: exploit-public-facing-application tactic: initial-access techniques: - T1190 - name: Command and Control via Multi-hop Proxy observables: - CAPEC methodology - multi-hop proxy chains - onion routing - Tor network traffic - 699.html - 513.html - Elastic Crawler slug: multi-hop-proxy-c2 tactic: command-and-control techniques: - T1090.003 summary: This intrusion scenario involves the exploitation of vulnerabilities in public-facing applications to gain initial access, followed by the establishment of command and control using multi-hop proxies and onion routing. The activity is documented through an automated pipeline that uses AI to draft security advisories by mapping raw vulnerability data to the MITRE CWE and CAPEC catalogs. severity: medium targets: analyst: name: Tier-2 analyst role: analyst endpoint: category: endpoint name: Endpoint telemetry (hb_ surfaces) telemetry: - endpoint hunter: agent: true name: Hunt agent network: category: network name: Network telemetry telemetry: - network web: category: siem name: Web server / proxy logs telemetry: - network tlp: clear type: investigation --- # Exploit and Multi-Hop Proxy C2 This hunt identifies internet-facing systems with unresolved high-severity vulnerabilities. It correlates these hosts with network behaviors indicative of multi-hop proxying. The hunt uses vulnerability findings as the lead to scope the investigation and then fans out to inspect egress port patterns and specific HTTP research indicators matching the MITRE documentation referenced in automated vulnerability research. An agent weighs these independent signals to determine if a vulnerable host has been compromised. ## unresolved-vulnerabilities Identify potential beachheads by listing hostnames with unresolved critical vulnerabilities. ```sqlite target=endpoint role=scoping ~~~yaml expected: A list of vulnerable hostnames. These systems are the primary targets for exploitation and subsequent proxy activity. reads: - device_uid - cve_uid - severity_id - status silence: not_evidence_of_absence source: hb_vulnerability_finding verified: dry-run verified_at: '2026-09-20' ~~~ SELECT DISTINCT d.hostname AS device_hostname, v.cve_uid, v.severity_id FROM hb_vulnerability_finding v JOIN hb_devices d ON v.device_uid = d.device_uid WHERE v.status = 'UNRESOLVED' AND v.severity_id >= 4 ``` ## correlate-egress-indicators parallel: - → rare-proxy-egress - → mitre-research-activity join: → triage-verdict ## rare-proxy-egress Find hosts connecting to common proxy ports where the destination is rare across the fleet, suggesting private C2 infrastructure. ```sqlite target=network role=baseline params=(lookback_days=lookback_days, proxy_ports=proxy_ports, scope_hosts=scope_hosts) ~~~yaml baseline: compare: first_seen window: '{{lookback_days}}d' expected: Connections to proxy ports from a small subset of the vulnerable estate. Silence means no proxy-like egress was observed. prevalence: by: device_hostname key: - dst_endpoint_ip - dst_endpoint_port rare_below: 4 reads: - device_hostname - process_name - dst_endpoint_ip - dst_endpoint_port - direction - time silence: not_evidence_of_absence source: hb_network_connection verified: dry-run verified_at: '2026-09-20' ~~~ SELECT device_hostname, process_name, dst_endpoint_ip, dst_endpoint_port, COUNT(DISTINCT device_hostname) AS host_count FROM hb_network_connection WHERE (('{{scope_hosts}}' = '') OR (instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0)) AND direction = 'outbound' AND instr(',' || '{{proxy_ports}}' || ',', ',' || CAST(dst_endpoint_port AS TEXT) || ',') > 0 AND time >= datetime('now', '-{{lookback_days}} days') GROUP BY dst_endpoint_ip, dst_endpoint_port HAVING host_count <= 3 ``` ## mitre-research-activity Detect requests to specific CWE and CAPEC pages originating from the server, which may indicate an attacker using interactive tools on the host. ```sqlite target=web role=enrichment params=(lookback_days=lookback_days, research_paths=research_paths, scope_hosts=scope_hosts) ~~~yaml expected: HTTP requests from internal servers to MITRE documentation. This logic assumes the adversary is performing live research or using automated tools that fetch context directly from the host. reads: - device_hostname - url_hostname - url_path - user_agent - time silence: not_evidence_of_absence source: hb_http_activity verified: dry-run verified_at: '2026-09-20' ~~~ SELECT device_hostname, url_hostname, url_path, user_agent, time FROM hb_http_activity WHERE (('{{scope_hosts}}' = '') OR (instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0)) AND LOWER(url_hostname) LIKE '%mitre.org%' AND (instr(',' || '{{research_paths}}' || ',', ',' || LOWER(url_path) || ',') > 0 OR LOWER(url_path) LIKE '%/definitions/%') AND time >= datetime('now', '-{{lookback_days}} days') ``` ## triage-verdict ```agent target=hunter cite: required context: - unresolved-vulnerabilities - rare-proxy-egress - mitre-research-activity max_iterations: 3 objective: Identify hosts that are vulnerable AND exhibit either rare proxy egress or unusual HTTP research activity. success_criteria: Verdicts citing specific hosts and evidence rows. tools: - endpoint - network - web ``` ## route-verdict if~: "the triage verdict is malicious for at least one host" (confidence: high, judge=hunter) then: → isolate-host indeterminate: → investigate-process unavailable: → investigate-process (blind_spot: no-http-telemetry) else: → remediate-vulnerability ## isolate-host ```action target=endpoint ~~~yaml approval: required ~~~ Isolate the endpoint and revoke any service account sessions originating from it. ``` → investigate-process ## investigate-process ```manual target=analyst Review hb_process_activity for the process_name identified in the proxy egress query. Check for suspicious parent processes and associated file activity. ``` → remediate-vulnerability ## remediate-vulnerability ```manual target=analyst Coordinate with the infrastructure team to patch the affected packages identified in the scoping step. Verify the fix using a subsequent hb_vulnerability_finding read. ``` → end